Proton releases a new app for two-factor authentication
Proton releases a new app for two-factor authentication
techcrunch.com
Proton releases a new app for two-factor authentication | TechCrunch
42 comments
-
-
It would be nice to have proton drive integration in linux. I guess it's a matter of priorities.
-
2 words I want you to keep in mind:
- Entranchment
- Enshittification
I purposely do not use the whole Proton suite for those reasons. It would be quite bad if one is entranched by their whole suite if they went on the enshittification route, which large companies eventually tend to do.
-
Everything in Proton is
- Open source
- Portable
-
Then please do link me the source code of their email protocol.
FairEmail's FAQ is the 1st thing that popped up on Github when searching for "proton", mentioning that it's proprietary:
https://github.com/M66B/FairEmail/blob/master/FAQ.md#faq129
-
Normally I use Aegis on my Android, paired with Authy on my iPad and work-issued iPhone as a backup of sorts (Aegis config is also backed up to multiple devices via Syncthing), but this seems like it would be more promising as a backup 2FA method instead of Authy.
-
Proton Pass already has this built in, is there any difference or is this just a standalone version?
-
It has some extra features, for example you can use it without an account
-
42 comments
I see Bitwarden didn’t make the comparison. Almost certainly because it also checks those boxes.
I’m a Proton guy, but even I have limits on how many eggs I put in the same basket.
I don't really get the "all eggs in one basket" problem with Proton Pass / Proton Auth.
Am I wrong in thinking that it depends on the specific service?
Some services are very hard to migrate and have a lot of vendor lock-in. For example, your e-mail address (if not using a custom domain) cannot be changed overnight, and it will probably take years to move everything over. Think carefully about where you put your e-mail!
I understand that cloud storage, especially when using non-standard formats for online collaboration, such as GSuite or Proton Docs, is also hard to move to a different provider. When choosing such an option, think carefully of how hard it will be to migrate away. Have a plan.
But switching between Bitwarden and Proton Pass is at most an hour of work. How is that problematic? Both apps store data locally so they continue to work when the provider's servers are offline.
Yes, Bitwarden has a self-host option with Vaultwarden, Proton Pass does not. So if you want to start using that, just export from Proton Pass and Proton Auth, import to Vaultwarden, sign in on your devices, and done. I don't see the problem of using Proton Pass.
Up voted you because you're asking valid questions and you are prompting people to give you and others solid advice, and thus you deserve visibility, as well as the answers given to your questions.
I hate it when people down vote valid and interesting questions. It's so stupid.
I think the argument is that if at some point Proton services get compromised, or if Proton somehow turn into the bad guys, then using fewer of their services will impact you less or give you more time to react. The same goes for any other vendor, of course, which is why the way you address this is by spreading your trust across different services/regions/owners/....
Yes. The concern is that if your account for your password manager is compromised, your passwords and 2FA tokens are both compromised. Whereas if you kept your 2FA in a different account, only your passwords are compromised. All services work this way. Proton has suggested creating a second account for your 2FA codes, even though it violates their own ToS.
That's why I tell everyone I know to get their own domain. Not just for email, but for a variety of things. If nothing else, I run a Linkstack that has all of my personal information, so when people ask me for it, I send them there, and let them contact me however they wish. I've actually managed to get it to the top of the Google search results somehow so people can just Google me and easily find it as well. It grants you a whole lot of autonomy over your digital identity.
Changing your email host is just a matter of a simple DNS config change. When I changed from Google it was indeed a nightmare. Several companies I realized don't even have mechanisms to change your email address because it is actually your identity in their system. I had to delete my account and open a new one. They had no other mechanism. Which is absurd. Other companies would send some things to my new email and other (important) things would continue to be sent to my old email, for reasons no one would explain to me. They are simply not technologically equipped to handle this sort of change. All in all it took about a year before I was comfortable deleting my Google account.
I think it’s entirely illogical. Likely, they were burned before, and cautious about using anything under one name ever again, even though the circumstances are slightly but substantially different in Proton vs (for example) Google.
If by not using proton you’ll have to switch services less, or it’ll somehow make switching services easier in the future, sure. But I don’t see any reason to believe that
As does Ente Auth. But really, how many apps do you expect them to list here? They've listed what are by far the most popular ones.
BitWarden isn't an authentication app. It's a whole password/login manager.
If that's you're comparison, you want Proton Pass, not Proton Authenticator.
Bitwarden does have a standalone authenticator now.
Mmm fair.
I tested migrating Bitwarden to Proton, but there were some incompatibilities, and I didn’t trust it not to mess something up. If I was starting from scratch, maybe I’d use Proton for passwords. Bitwarden does the job though, and it’s way cheaper.
What if I'm fine with ads but not tracking, or vice versa? Why combine them like that? I guess it's easier to put a no-pass on the others if there're more attributes in one row.
Because virtually all ads involve some kind of tracking.